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Mini Review 


In a fast-evolving world, where information sharing has 
become part of our everyday life, the right to protect our 
lives, our identities, our work and our health has become 
very important. Privacy and personal data constitute an 
important aspect of private life and in medical settings their 
protection becomes even more important. Individuals in 
general, but health care providers too when they become 
patients, refuse or prefer not to share any information 
which they might thing could compromise their way of life, 
the behavior of other people towards them, they believe is 
embarrassing or might make them subject to discrimination. 
Patients may also avoid seeking medical care if they believe 
that their personal data will be easily accessed by anyone. 
While It is certain that at some point in our life we all need 
medical help, whether it is a visit to the doctor, medical or 
dental treatment, medication, mental help, etc. the protection 
of personal data in medical care becomes of paramount 
importance, benefiting not only the patient, but society as a 
whole. Every government’s role is to protect the health and 
life of its citizens, where the protection of personal data forms 
part of the individual’ private life. Without such protection 
public safety, national security or the economic well-being of 
the country are jeopardized. 


History of Medical Confidentiality 


Confidentiality is an important legal and ethical principle 
in medical care, deeply rooted in the history of mankind. It is 
first found in the Hippocratic Oath of 5-th century BC, which 
required medical practitioners to never divulge whatever 
seen or heard in the course of their profession and hold such 
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information to be holy secrets. However, the requirement for 
physicians to maintain professional secrecy was also known 
in the later Roman Empire in the 4th century. Confidentiality 
as a principle was first mentioned in what has been 
considered as the first modern ethical code of medical ethics, 
published by Thomas Percival in 1803 Higgins GL, et al. [1]. 


Protection of confidentiality derives from the right to 
privacy (known as such in USA) or right to private life (as 
known in Europe). The right to privacy was first introduced 
in 1890 by two United States lawyers, Samuel D. Warren and 
Louis Brandeis, who described it as the “right to be left alone” 
Samuel D, et al. [2]. Such principle was further developed to 
also include the right to the protection of confidentiality of 
information and personal data. The privacy of the individual 
is highly prized in most societies and widely accepted as a 
civil right. 


The importance of confidentiality in medical care was 
repeated in the Declaration of Geneva of 1948, adopted by the 
General Assembly of the World Medical Association (WMA) 
[3]. Even though the U.S. Constitution of the United States of 
America does not specify a “right to privacy”, according to 
American jurisprudence such right is alluded to in the Fourth 
Amendment of the US Constitution, as well as the Bill of 
Rights (UMKC, 2020). Meanwhile, in 1950 in Europe [4], the 
European Convention on Human Rights, Article 8, provided 
for individual’s right to private and family life [4]. Same 
protection was also included in the American Convention on 
Human Rights of 1969, Article 11 [5]. 


Privacy rights with respect to individual healthcare 
decisions and health information have been further outlined 
in court decisions, state statutes and legislation, professional 
codes of ethics and guidelines. 


Good medical practice depends upon patients being able 


to discuss openly with the doctor the aspects of their health 
on the understanding that such details will be kept secret. 
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It follows that any disclosure contrary to the individual’s 
interest is also potentially detrimental to the public interest 
since it may discourage confiding in future. With no 
guarantee that their secrets will be protected, patients may 
withhold important information about their health care and 
also about the wellbeing of others etc. A particular aspect of 
medical confidentiality has to do with the question of “truth 
telling” Cipi B, et al. [6]. 


Trust is an essential part of doctor/healthcare provider- 
patient relationship. Trust in a doctor-patient relationship 
is something that involves both confidence and reliance. 
The patients are put in a vulnerable situation where they 
believe that the care-providers will care for their interest. 
For their own good, patients need to trust the doctors with 
their private information and body which is essential for 
their proper management. Trust in the medical field can be 
considered as either institutional trust or interpersonal trust. 
For healthcare system, interpersonal trust is built, sustained 
or damaged through face to face encounters with health 
care providers. As for the institutional trust, it is placed on 
the medical system or the institution. The doctor-patient 
interaction is influenced by both personality and social 
systems and trust occurs in a framework of interaction which 
is influenced by personality and social systems Chandra §S, et 
al. [7]. 


Breaches of confidentiality in clinical practice due to 
carelessness, indiscretion, or sometimes even maliciously, 
jeopardize a duty inherent in the doctor-patient relationship. 
Confidentiality breaches can be related to the custody of 
clinical histories and records (admission forms, clinical 
and nursing report sheets, laboratory tests and other 
complementary examinations, and any other type of record 
containing patient data), as well as computer access to such 
records; to the consultation and/or disclosure of clinical 
and/or personal data to medical personnel not involved in 
the patient’s clinical care, as well as people external to the 
hospital; or situations in which the improper disclosure of the 
patient’s clinical data results from inadequate infrastructure, 
equipment, or poor organization of the hospital Cristina MBA, 
et al. [8]. Sometimes, such breaches can even be intentional, 
through p.ex. Disclosure of sensitive patient data to third 
parties, such as to pharmaceutical companies or companies 
dealing with analytics of patient data, etc. 


Thus, governments have a duty to protect the principle 
of confidentiality in medical care. But, is this duty absolute? 
Should confidentiality be protected at any costs or are there 
limitations to such right? 


Disclosure of Patient Information 


World Health Organization considers health to be a state 
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of complete physical, mental and social well-being and not 
merely the absence of disease or infirmity WHO [9]. 


According to the Code of Medical Ethics (CME) of the 
American Medical Association (AMA), patient privacy 
encompasses a number of aspects, including personal 
space (physical privacy), personal data (informational 
privacy), personal choices including cultural and religious 
affiliations (decisional privacy), and personal relationships 
with family members and other intimates (associational 
privacy). Patients need to be able to trust that physicians will 
protect information shared in confidence. Physicians in turn 
have an ethical obligation to preserve the confidentiality 
of information gathered in association with the care of the 
patient. In general, patients are entitled to decide whether 
and to whom their personal health information is disclosed. 
However, specific consent is not required in all situations. 
CME recognizes certain situations when information on the 
patient can be disclosed: 
> With the consent of the patient; 
> Without the consent of the patient. Such information 

can be shared to other health care personal for the 
purpose of providing care; to the authorities when 
such is required by law; to other third parties situated 
to mitigate the threat when in the physician’s judgment 
there is a reasonable probability that the patient will 
seriously harm him/herself or the patient will inflict 
serious physical harm on an identifiable individual or 
individuals. 


According to Article 7 of Principles of European Medical 
Ethics (PEME) of the European Council of Medical Orders 
(ECMO) the doctor must guarantee the complete secrecy of 
all the information collected and the findings made during 
his or her contact with the patient. The patient’s death 
does not exempt the doctor from medical confidentiality. 
The doctor must respect the patient’s privacy and take all 
necessary measures to render impossible the disclosure of 
all the information he or she has acquired while exercising 
his or her profession. If exceptions to medical confidentiality 
are provided for by national law, the doctor may ask for the 
prior opinion of his association or the professional body of 
similar competence CEOM [10]. 


While the provisions on medical confidentiality by the 
CME of the American Medical Association and the Principles 
of European Medical Ethics of the European Council of 
Medical Orders seem to give a general approach to such 
principle, the guidelines provided by United Kingdom’s 
General Medical Council (GMC) seem more pragmatic. 
Apart from the cases provided by CME and PEME, GMC also 
recognizes cases where disclosure of patient information is 
ordered by a court or where such disclosure is justified in the 
public interest GMC [11]. 
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Case-law on Medical Confidentiality 


Confidentiality in medical care has become such an 
important principle in medical care based also on the large 
case-law on the matter in all parts of the world. It must be 
stressed that medical law and ethics are becoming more and 
more important in medical care. In several cases the courts 
have opted for the protection of the confidentiality principle, 
in others for the protection of public interest. 


In the case-law of the USA there are many cases on the 
protection or disclosure of patient information. Some of 
them are of particular importance with regard to patient 
confidentiality. 


In Commonwealth v. Wiseman, 356 Mass. 251 [12] a 
filmmaker was sued for violating certain conditions he had 
agreed to in the filming of a state hospital. The court found 
that the First Amendment interest in having specialists in 
the fields of psychiatry and public health view the film was 
strong enough to outweigh patient privacy interest. 


In Tarasoff v. Regents of the University of California, 17 
Cal 3d 425 a therapist was held to have a duty to disclose 
private patient information to a third party in danger after 
his patient informed him of intention to murder a girl and 
then acted on it. Thus, public interest includes information 
that is relevant to public health or that is newsworthy and 
part of the public record. 


In Doe v. Roe [13] the plaintiff sued her former 
psychiatrist, “Dr. Roe,” over a book that chronicled the 
treatment of herself and her late husband. Although the 
patients’ names were not included in the book and Dr. Roe 
had changed a number of facts, Doe argued that the inclusion 
of certain details revealed her identity to acquaintances. The 
New York Supreme Court held that Dr. Roe had entered into 
a contract with her patients to keep matters in confidence 
and had violated patient confidentiality with the publishing 
of her book. 


In Jaffee v. Redmond, 518 U.S.1 [14], the Court ruled 
that confidential communications between a _ licensed 
psychotherapist and her patients in the course of diagnosis 
or treatment are protected from compelled disclosure. 


In M.A.K. v. Rush-Presbyterian-St.-Luke’s Medical Center, 
316 Ill. App. 3d 156 [15], the plaintiff filed suit against 
the hospital, complaining of this release of information 
to an insurance company on the time spent by him on a 
rehabilitation from alcoholism program. He asserted that 
the physician-patient relationship had been violated, that 
his privacy had been invaded, and that there had been a 
negligent infliction of emotional distress. The circuit court 
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granted the defendant hospital a judgment on the pleadings. 


In the case-law of the European Court of Human 
Rights (ECOHR) there have also been several cases on the 
confidentiality of medical data, which the Court held that 
felt within the protection guaranteed by Article 8 of the 
European Convention on Human Rights (The Convention)- 
“Private and family life”. 


In Z. v. Finland the applicant’s ex-husband had been 
convicted of manslaughter for having knowingly exposed his 
victims to the risk of HIV infection. During the proceedings, 
despite her disapproval, the applicant’s doctor and 
psychiatrist were called to give evidence about the applicant’s 
medical condition. The national courts ordered that the full 
judgment, which mentioned the applicant’s full name, and 
the case documents remain confidential for ten years. The 
Court found that the questioning of the applicant’s medical 
advisers had been justified in the circumstances, since it was 
crucial in establishing when her former husband had become 
aware of his HIV infection and whether he was to be tried for 
manslaughter or a less serious offence. On the other hand, 
the Court found that a violation of Article 8 would occur if 
the applicant’s medical data were made publicly accessible 
as early as ten years after her former husband’s conviction. 
Observing that the applicant’s medical data had become part 
of the criminal proceedings against her ex-husband without 
her consent, the decision to reveal the entire case-file so 
early on would not be supported by reasons which could 
be considered sufficient to override her interest in the data 
remaining confidential for a longer period. 


In I. v. Finland the applicant, an HIV-positive nurse, 
suspected that unauthorized persons had accessed her 
medical records [16]. While the strict application of domestic 
law would have constituted a substantial safeguard in her 
case, the system at the hospital made it impossible to clarify 
retroactively the use of patient records or to determine 
whether information contained on the applicant and her 
family had been given to or accessed by unauthorized parties. 
Moreover, at the material time the records could also be read 
by staff not directly involved in her treatment. Although the 
hospital had subsequently taken ad hoc measures to protect 
the applicant against unauthorized disclosures by restricting 
access to treating personnel and registering her under a 
false name and social-security number, this had come too 
late. What had been required in the applicant’s situation was 
practical and effective protection to exclude any possibility 
of unauthorized access occurring in the first place. The Court 
therefore found a violation of Article 8. 


In Biriuk v. Lithuania [17] the applicants sued a 
newspaper for breach of privacy after it published a front- 


page article quoting hospital staff as saying they were HIV 
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positive. The article went on to give other details about 
their private life. Although the domestic courts found in the 
applicants’ favor, they were unable to award more than the 
statutory maximum of EUR 2,900. The Court considered it 
crucial for domestic law to safeguard patient confidentiality 
and discourage any disclosures of personal data, especially 
bearing in mind the negative impact of such disclosures 
on the willingness of people at risk to take voluntary tests 
for HIV and seek treatment. In such cases of outrageous 
abuse of press freedom, the severe statutory limitations on 
judicial discretion in redressing the damage suffered thereby 
deterring recurrences had failed to provide the applicants 
with the protection of privacy they could have legitimately 
expected. There had thus been a violation of Article 8. 


On the other hand, the Court has also acknowledged that 
the interests of a patient and the community as a whole in 
protecting the confidentiality of medical data may, in certain 
situations, be outweighed by the interests of investigating 
crime or of holding court proceedings in public. 


In Avilkina and others v. Russia [18] a deputy prosecutor 
required medical institutions to report all refusals of a blood 
transfusion by Jehovah’s Witnesses. As a result, he was 
informed of the second applicant’s chemotherapy in a public 
hospital following a non-blood management treatment plan 
and of the fourth applicant’s refusal ofthe use of foreign blood 
for surgical treatment. The Court observed that the applicants 
were not suspects or accused in any criminal proceedings 
and the prosecutor was merely conducting an investigation 
into the activities of a religious organization in response to 
complaints received by his office. There had consequently 
been no pressing social need to request the disclosure of the 
confidential medical information concerning the applicants. 
In fact, other options had been available to the prosecutor to 
follow up on the complaints, such as seeking the applicants’ 
consent to disclosure or questioning them about the matter. 
The Court found a violation of Article 8 of the Convention. 


Conclusion 


The principle of confidentiality is of paramount 
importance in medical care. Respecting the confidentiality of 
health data is crucial not only for the protection of a patient’s 
privacy but also for the maintenance of that person’s 
confidence in the medical profession and in the health 
services in general as disclosure of confidential information 
given to the medical care providers, in the course of their 
duty to provide medical care, may seriously affect a person’s 
private and family life, their social and employment situation, 
as well as the health and society as a whole. If such principle 
is not respected, life, liberty, freedom of movement can be 
jeopardized and as a result of this, social order and economic 
wellbeing as well. 
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As a conclusion, when discussing cases on whether 
patient information should be disclosed or not, each case is 
different and as such must be reviewed and decided bearing 
in mind its circumstances of the case and the possible 
consequences it might bring not only to the patient, but 
society too. 
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